Data Processing Agreement
What nOS may do with student records, and what happens when a school leaves.
FERPA-aligned · Student Data protection. Effective October 4, 2026. Governing law: State of North Carolina. nOS LLC. Version 4.0.0.
This Data Processing Agreement ("DPA") is between nOS LLC, a limited liability company organized under the laws of the State of North Carolina ("nOS"), and the educational institution that signs it in the Service ("School"). It is part of the Master Services Agreement and Order Form ("MSA") and governs how nOS handles Student Data and other School Data for the School.
The terms "School Data," "Student Data," "Personal Information," "Security Incident," "Subprocessor," "Service" and "Authorized Users" have the meanings the MSA gives them. For Student Data, this DPA controls over the MSA and the Terms of Service.
1. FERPA designation
1.1 School official. The School designates nOS as a "school official" with a "legitimate educational interest" under the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, and 34 C.F.R. Part 99 ("FERPA"). nOS performs a service the School would otherwise do itself. nOS is under the School's direct control for its use and maintenance of Student Data, and accesses Student Data only as needed to provide the Service and as the School directs.
1.2 Use only for the School's purposes. nOS uses Student Data only for the purposes for which the School disclosed it, set out in Section 2.2. nOS keeps education records confidential and follows FERPA in how it handles them.
1.3 No redisclosure. As a school official, nOS is subject to 34 C.F.R. § 99.33(a). It does not disclose Student Data to anyone else except as that rule allows: with the School's prior written authorisation, or with the consent of the parent or eligible student. Subprocessors named in Section 10 act for nOS in providing the Service and are bound by these same limits. If a law or court order forces nOS to disclose Student Data, nOS tells the School first, to the extent the law permits.
1.4 The School decides. On the School's written instruction nOS will correct, return or delete Student Data at any time, not only at the end of the subscription. nOS limits access to Student Data to the people who need it to provide or support the Service.
2. What data nOS holds, and why
2.1 Data elements. The School decides what it puts into the Service. Where the School provides them, nOS holds the following. Student data: names, student IDs, grade level, gender, course requests, completed courses and credits, cohort, team or track, and schedules. School-entered program indicators, such as IEP, 504 and English-learner flags and service schedules, but only if the School enters them. Student and family email addresses, when the School uses request forms. Students' answers on request forms, including free-text answers. Original files the School uploads, which nOS stores as uploaded. Teacher and staff data: names, emails, availability and assignments. Room data. Account and usage logs, such as sign-ins, audit history and nOS AI conversations.
2.2 Purposes. nOS processes School Data only to build and improve the School's master schedule, give scheduling reports to the School's Authorized Users, and support scheduling functions the School directs inside the Service. It uses School Data for nothing else.
2.3 Student information systems. If the School directs nOS to connect to its student information system (for example PowerSchool, Blackbaud, Aeries or Veracross), nOS imports from or sends to that system only as the School directs, using credentials the School supplies. nOS stores those credentials encrypted with AES-256-GCM. The School's student information system belongs to the School or its own vendor and is not a nOS Subprocessor.
2.4 Request forms that students fill in. If the School opens a course-request form, students reach nOS through a link the School sends and enter their own choices. They do this at the School's direction. A student confirms who they are with the student ID, name and grade the School already gave nOS, and nOS shows nothing about any other student. What a student adds is their course choices, rankings or alternates, and any answers the School's form asks for, including free text. nOS asks for no home address and no payment method. nOS uses what students enter only for the School.
2.5 School consent for students under 13. The School directs this collection and, under the Children's Online Privacy Protection Act and its Rule (16 C.F.R. Part 312), gives consent for it in place of parents. The Federal Trade Commission's guidance lets a school do this when the information is used only for the school's educational purpose. nOS holds itself to the conditions that guidance sets. What a student submits is used only to build that School's schedule. It is never used for advertising, marketing, profiling a student, or any other commercial purpose. It is disclosed to no one except the School and the Subprocessors in Section 10. It is kept and deleted under Section 6 like every other kind of Student Data. Sections 2.1, 2.2 and 6, read together, say what is collected, how it is used and how long it is kept. A parent who wants to see, correct or delete what their child submitted asks the School, and nOS acts on the School's instruction under Sections 1.4 and 8. The School remains responsible for any notice to parents that its own policies or state law require before it opens a form.
3. What nOS will not do
3.1 No sale. nOS does not sell, rent or trade Student Data, or share it for a commercial purpose.
3.2 No advertising and no unrelated profiling. nOS does not use Student Data for targeted advertising, to build advertising profiles, or to build a profile of a student for any purpose unrelated to the School's scheduling.
3.3 No training of AI models. nOS does not use Student Data to train, fine-tune or improve any artificial-intelligence or machine-learning model. It does not combine one school's data with another's for that purpose.
3.4 nOS AI. When an Authorized User uses nOS AI, nOS sends the context needed to answer, which can include student names and schedule or roster details, to its AI Subprocessor, Anthropic PBC, through its API. Anthropic processes it only to produce the answer. nOS uses Anthropic under commercial terms that bar Anthropic from training its models on nOS's inputs or outputs. Anthropic keeps the content for a limited time under those terms. nOS does not claim that Anthropic keeps nothing. nOS remains responsible for Anthropic's compliance with duties at least as protective as this DPA.
3.5 Only on the School's instructions. nOS processes School Data only on the School's documented instructions, as set out in this DPA and the MSA, unless the law requires otherwise. If it does, nOS tells the School before processing, to the extent the law allows.
4. Security
4.1 Measures. nOS keeps reasonable administrative, technical and physical safeguards for School Data that fit its sensitivity. They include encryption in transit using TLS, and encryption at rest provided by its hosting and database providers. They also include AES-256-GCM encryption of stored student information system credentials, and access to School Data limited to the founder and operator of nOS, who needs it to run and support the Service.
4.2 Operator access to a School's account. A nOS operator opens a School's account (to view as a user, or to watch a live session) only to give the School support or to investigate a problem. Each access is recorded in the School's security log in the Service (Settings → Security), together with the reason the operator gave. Watching a School's live session also sends an email to the School's administrators.
4.3 The School's part. The School keeps its Authorized Users' sign-in details safe, removes people who should no longer have access, and tells nOS promptly at bennettmiller@nosplanner.com if it suspects unauthorised use.
5. Subprocessors
5.1 Duties. nOS uses the Subprocessors listed in Section 10 to provide the Service. Each is bound by written data-protection duties at least as protective as this DPA, or by terms that give the same protection. nOS is responsible for its Subprocessors' handling of School Data.
5.2 Changes and objection. nOS gives the School's administrators at least thirty (30) days' notice before it adds a Subprocessor that stores or can read School Data. If the School has a reasonable objection that the parties cannot resolve in good faith, the School may end the affected subscription. nOS refunds the prepaid fees for the unused part of the term, pro rata.
5.3 Public list. nOS also publishes its Subprocessor List at usenos.org/legal#subprocessors, and will send it on request at bennettmiller@nosplanner.com.
6. Keeping and deleting data
6.1 Keeping. nOS keeps School Data only while the School's agreement is in force, plus the time in this Section.
6.2 Export Window. The School can export its School Data at any time in the Service (Settings → School, "Download everything"), and may ask nOS for a copy in a commonly used, machine-readable format. After the agreement ends, nOS makes School Data available for export on written request until it is deleted.
6.3 Deletion after the agreement ends. nOS deletes School Data within sixty (60) days after the agreement ends, unless the law requires nOS to keep it. The School may ask for deletion sooner, at any time. nOS then deletes the data and gives the School written confirmation of the deletion.
6.4 Free trial that ends without a plan. nOS deletes the School Data of a trial account ninety (90) days after the trial ends, if no plan has started. nOS emails the School's administrators a warning before it does.
6.5 Recovery copy and backups. When a school is deleted, nOS keeps a recovery copy for thirty (30) days so that a mistaken deletion can be reversed, and then removes it. Backups that held the data roll off within thirty-five (35) days after deletion. nOS does not restore backups in order to read data that has been deleted.
6.6 nOS AI conversations. nOS stores nOS AI conversations in the School's account so that its users can return to them. They are School Data. nOS keeps them for up to seven hundred thirty (730) days, or until the School deletes them or the agreement ends, whichever comes first. Content sent to Anthropic to produce an answer is covered by Section 3.4.
6.7 What deletion covers. Deletion removes School Data from nOS's production systems and file storage, and from the Subprocessors that hold it for nOS, as far as their systems allow, except as Section 6.5 and the law allow.
7. Security Incidents
7.1 Notice. nOS will tell the School about a Security Incident that affects the School's data without unreasonable delay, and no later than seventy-two (72) hours after nOS confirms the Security Incident. This one trigger, confirmation by nOS, applies throughout this DPA.
7.2 What the notice says. The notice states, as far as nOS knows: what happened; what kinds of data and roughly how many people and records are affected; the likely consequences; and what nOS has done and will do. nOS sends more as it learns more.
7.3 Cooperation and costs. nOS investigates and stops the incident and bears its own costs of doing so. It cooperates with the School's investigation and helps with the notices the School must give to individuals or authorities. Where the Security Incident was caused by nOS's breach of this DPA, nOS reimburses the School's reasonable costs of giving those notices. These payments count toward the higher cap in Section 11 of the MSA.
8. Rights of parents, students and staff
Where privacy law gives a person a right to see, correct or delete Personal Information, nOS helps the School respond, in the ways the Service allows. The School holds the educational record and answers the request within the time the law sets. nOS acts on the School's instruction and does not decide for itself whether a record is accurate.
9. Audits
Once a year, on reasonable written request, nOS provides documents or completes a reasonable security questionnaire so the School can check that nOS follows this DPA. After a Security Incident, the School may ask for more detail about it. nOS has no SOC 2 report, and does not claim one.
10. Where data is stored, and Subprocessors
10.1 Storage. School Data at rest, which means the production database, stored files and backups, is held on servers in the United States. nOS will not move that storage outside the United States without the School's prior written consent.
10.2 Subprocessors that store or can read School Data. Each is named with what it does and where. (a) Vercel Inc.: hosting, the functions that run the Service, file storage for uploaded and exported files at rest (Vercel Blob), and background workflows. United States. (b) Neon, Inc.: the Postgres database. United States. (c) Anthropic PBC: nOS AI, as Section 3.4 describes. United States. (d) Ably Realtime Ltd.: the transport for live collaboration, described in Section 10.3. Based in the United Kingdom. (e) Upstash, Inc.: rate limiting, using counters keyed by hashed identifiers rather than names. United States. (f) Email providers for account emails and request-form emails, which can carry student and family email addresses and the links the School sends: Google Workspace (SMTP) and, as a fallback, Resend. (g) Sentry, only if nOS has error reporting turned on: error reports are scrubbed of School Data before they are sent.
Providers that do not receive Student Data: Stripe, Inc. (billing; it receives billing contact and payment details, never Student Data) and Google (optional sign-in; it receives only the account email).
10.3 Live collaboration is the one transport that is not United States-only. Messages for shared presence, live cursors, follow mode and an open nOS AI conversation shared with colleagues travel over Ably, which is based in the United Kingdom and may route messages through edges outside the United States. Each message is encrypted in the sender's browser with a per-School key that nOS derives and never gives to Ably, before it leaves the browser. Channel names are one-way digests, not school names or identifiers. What crosses that transport is ciphertext that Ably cannot read, and history and persistence are switched off on those channels. A School that prefers no part of the Service use that transport may ask nOS at bennettmiller@nosplanner.com to turn live collaboration off for it. Nothing else in the Service is affected.
11. Liability
Each party's liability under this DPA is governed by Section 11 of the MSA. For nOS's breach of its data-protection duties in this DPA, the higher cap in that Section applies. Neither cap applies to fraud or wilful misconduct.
12. Term, changes and signature
This DPA lasts as long as the MSA. Its deletion and confidentiality duties continue until all School Data has been deleted or returned.
nOS will not make a material change to the data-protection commitments in this DPA without at least thirty (30) days' written notice to the School's administrators. A School that does not accept a material change may end the affected subscription without penalty and export its School Data under Section 6.
The parties sign this DPA as of the effective date. The School signs in the Service, and the person signing confirms they are authorised to bind the School. nOS LLC's signature is on file. Notices to nOS: bennettmiller@nosplanner.com. Postal notices go to the address nOS lists at usenos.org/legal.
Exhibit A — New York Education Law § 2-d Supplemental Information
This Exhibit is the supplemental information a third-party contractor gives a New York educational agency, to be published with that agency's Parents' Bill of Rights for Data Privacy and Security. It repeats commitments made elsewhere in this DPA, and nothing in it is a lesser promise. nOS gives it to every School, because a School outside New York asks the same questions.
The exclusive purposes for which Student Data will be used. To build and improve the School's master schedule, give scheduling reports to the School's Authorized Users, and support scheduling functions the School directs, and for nothing else. See Section 2.2.
How nOS makes sure that subcontractors and other authorised persons follow data-protection duties. Every Subprocessor is bound by written duties at least as protective as this DPA, and is listed with its purpose and location in Section 10. New Subprocessors that store or can read School Data carry thirty (30) days' notice and a right to object. Inside nOS, access is limited to the founder and operator. See Sections 1.4, 4 and 5.
When the agreement expires, and what happens to Student Data then. nOS deletes School Data within sixty (60) days after the agreement ends. The School can export it first and can ask for earlier deletion, and nOS confirms deletion in writing. A recovery copy is removed after thirty (30) days, and backups roll off within thirty-five (35) days after deletion. See Section 6.
How a parent, student or eligible student may challenge the accuracy of Student Data. They ask the School, which holds the educational record. nOS corrects or deletes on the School's instruction and helps the School respond. See Sections 1.4 and 8.
Where Student Data will be stored, and how it is protected. School Data at rest is stored in the United States, and Section 10 names the one transport that is not United States-only and the encryption that covers it. Security measures are in Section 4.
Encryption. Student Data is encrypted in transit using TLS and encrypted at rest by nOS's hosting and database providers. Student information system credentials are encrypted with AES-256-GCM. Live collaboration messages are also encrypted in the browser with a per-School key that is never given to the transport provider. See Sections 4 and 10.
Security Incident notice. nOS tells the School without unreasonable delay, and no later than seventy-two (72) hours after nOS confirms a Security Incident affecting the School's data, and cooperates with the School's investigation and with any notice the School must give. See Section 7.
This is the text a school signs in nOS, version 4.0.0. A signed copy, with the date, the signer and a hash of the exact text, is in the app under Settings › Agreements. All documents: Legal.